CVE-2016-6609: phpMyAdmin PHP code injection
Summary
CVE-2016-6609: phpMyAdmin PHP code injection. Affects phpmyadmin/phpmyadmin across 3 version ranges.
>= 4.0, < 4.0.10.17
>= 4.4, < 4.4.15.8
>= 4.6, < 4.6.4
Fixed in 4.0.10.17, 4.4.15.8 or 4.6.4, depending on the release line you run. How to fix ↓
Also tracked for
- phpmyadmin · Alpine:v3.2
The same CVE-2016-6609 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
phpMyAdmin is a popular open-source tool for managing MySQL databases through a web interface. It provides users with a convenient way to perform various database operations such as creating, modifying, and deleting tables, executing SQL queries, and managing user permissions. However, a vulnerability has been discovered in phpMyAdmin that allows for PHP code injection.
Vulnerability Detail
The vulnerability arises from a flaw in the handling of database names in phpMyAdmin. By crafting a specially designed database name, an attacker can execute arbitrary PHP commands through the array export feature. This can lead to unauthorized access, data manipulation, and potentially complete compromise of the affected system. The vulnerability affects all versions of phpMyAdmin 4.6.x (prior to 4.6.4), 4.4.x (prior to 4.4.15.8), and 4.0.x (prior to 4.0.10.17).
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 4.0, < 4.0.10.174.0.10.17composer require phpmyadmin/phpmyadmin:4.0.10.17 -
>= 4.4, < 4.4.15.84.4.15.8composer require phpmyadmin/phpmyadmin:4.4.15.8 -
>= 4.6, < 4.6.44.6.4composer require phpmyadmin/phpmyadmin:4.6.4
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
If upgrading phpMyAdmin is not immediately feasible, a temporary workaround is to disable the array export feature. This can be done by modifying the phpMyAdmin configuration to remove or comment out the 'Export' section in the 'libraries/config.default.php' file. However, this workaround should only be considered as a temporary measure, and upgrading to the latest secure version is strongly recommended.
Conclusion
The phpMyAdmin PHP code injection vulnerability (CVE-2016-6609) allows for the execution of arbitrary PHP commands through a specially crafted database name. This can lead to unauthorized access, data manipulation, and potential compromise of the affected system. To mitigate this vulnerability, it is crucial to upgrade phpMyAdmin to the latest secure version (4.6.4, 4.4.15.8, or 4.0.10.17) and regularly apply updates. For further assistance and support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for phpmyadmin/phpmyadmin →
FAQ
phpMyAdmin is an open-source tool for managing MySQL databases through a web interface. It provides a user-friendly way to perform various database operations.
The vulnerability allows for PHP code injection, which can lead to unauthorized access, data manipulation, and potential compromise of the affected system.
All versions of phpMyAdmin 4.6.x (prior to 4.6.4), 4.4.x (prior to 4.4.15.8), and 4.0.x (prior to 4.0.10.17) are affected.
Upgrade phpMyAdmin to version 4.6.4 if using 4.6.x, version 4.4.15.8 if using 4.4.x, or version 4.0.10.17 if using 4.0.x. Regularly updating phpMyAdmin is important for applying security patches.
A temporary workaround is to disable the array export feature by modifying the phpMyAdmin configuration. However, upgrading to the latest secure version is strongly recommended.
Related vulnerabilities
Recent vulnerabilities recorded for phpmyadmin/phpmyadmin.
